public inbox for glibc-cvs@sourceware.org
help / color / mirror / Atom feed
* [glibc] syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)
@ 2024-01-30 18:02 Arjun Shankar
0 siblings, 0 replies; only message in thread
From: Arjun Shankar @ 2024-01-30 18:02 UTC (permalink / raw)
To: glibc-cvs
https://sourceware.org/git/gitweb.cgi?p=glibc.git;h=ddf542da94caf97ff43cc2875c88749880b7259b
commit ddf542da94caf97ff43cc2875c88749880b7259b
Author: Arjun Shankar <arjun@redhat.com>
Date: Mon Jan 15 17:44:45 2024 +0100
syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780)
__vsyslog_internal calculated a buffer size by adding two integers, but
did not first check if the addition would overflow. This commit fixes
that.
Reviewed-by: Carlos O'Donell <carlos@redhat.com>
Tested-by: Carlos O'Donell <carlos@redhat.com>
Diff:
---
misc/syslog.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/misc/syslog.c b/misc/syslog.c
index 53440e47ad..4af87f54fd 100644
--- a/misc/syslog.c
+++ b/misc/syslog.c
@@ -41,6 +41,7 @@ static char sccsid[] = "@(#)syslog.c 8.4 (Berkeley) 3/18/94";
#include <sys/uio.h>
#include <sys/un.h>
#include <syslog.h>
+#include <limits.h>
static int LogType = SOCK_DGRAM; /* type of socket connection */
static int LogFile = -1; /* fd for log */
@@ -219,7 +220,7 @@ __vsyslog_internal (int pri, const char *fmt, va_list ap,
vl = __vsnprintf_internal (pos, len, fmt, apc, mode_flags);
va_end (apc);
- if (vl < 0)
+ if (vl < 0 || vl >= INT_MAX - l)
goto out;
if (vl >= len)
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2024-01-30 18:02 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2024-01-30 18:02 [glibc] syslog: Fix integer overflow in __vsyslog_internal (CVE-2023-6780) Arjun Shankar
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).